SSOGEN / Keycloak vs SSOGEN: What Each Product Documents
Compare
Keycloak vs SSOGEN: What Each Product Documents
Keycloak vs SSOGEN is a comparison of an open-source single sign-on project with a commercial identity provider that adds an Apache module, a gateway and AI agent identities. The table sets out what each documents.
Keycloak vs SSOGEN starts with one shared job: both are the identity provider your apps redirect to. SSOGEN also takes Keycloak as an upstream SAML or OpenID Connect provider.
SSOGEN adds what an open source project leaves to you: its own Web Agent for Oracle E-Business Suite, PeopleSoft and JD Edwards, a Gateway for apps that cannot change, and identities for AI agents. The table lines up each capability, row by row.
Facts about Keycloak come from Keycloak’s own site, its server administration guide and its securing-applications overview, read 2026-10-09.
Facts about SSOGEN come from SSOGEN’s product documentation. This page does not rank the products and says nothing about pricing or quality.
To plan a move, see the Keycloak alternative page.
Capability table
Last compared 2026-10-09. Products change; check current documentation first.
“Not described” means the pages we read (the homepage, the server administration guide and the securing-applications overview) do not mention it. It does not mean the capability is missing, or that Keycloak’s ecosystem cannot provide it.
| Capability | Keycloak (own documentation, read 2026-10-09) | SSOGEN (own documentation) |
|---|---|---|
| What it is | The administration guide calls it “a single sign on solution for web apps and RESTful web services” (guide). The homepage says it is a Cloud Native Computing Foundation incubation project (homepage). | A complete identity provider with local users, LDAP or Active Directory and SAML and OpenID Connect providers, plus MFA, policies, provisioning and the audit log. |
| Standard protocols | OpenID Connect, OAuth 2.0 and SAML (homepage). | SAML 2.0 and OpenID Connect, for applications and for upstream providers. Any application that speaks either connects now, with no catalog entry needed. |
| Directories | The guide says you can “hook it into existing LDAP and Active Directory servers”, and lists User Federation to sync users from them (guide). | Active Directory or LDAP over LDAPS, local accounts, CSV import. |
| Upstream providers | Identity brokering with external OpenID Connect or SAML identity providers, and social login (guide). | Entra ID, Okta, Keycloak and any SAML or OpenID Connect provider. |
| Second factor | Two-factor authentication with passkey, recovery codes and TOTP/HOTP, and step-up authentication support (guide). | MFA with step-up through sign-in policies: authenticator app (TOTP), passkeys, recovery codes, and the SSOGEN Authenticator. |
| Apache module for apps with no SAML or OIDC | The securing-applications guide points to two third-party Apache modules, mod_auth_openidc for OpenID Connect (guide) and mod_auth_mellon for SAML (guide), and says “Keycloak does not provide any official support” for either. | The Web Agent for Apache 2.4, Apache 2.2 and Oracle HTTP Server, with no application code change. |
| Gateway for unmodified internal apps | Not described on the homepage, in the administration guide or in the securing-applications overview. That overview says “Most of the support for some of these protocols is already available from the programming language, framework, or reverse proxy they are using.” | The Gateway: App Proxy, Remote Access, Outbound Connector, Directory Connector. |
| AI agent identities | Not described on the homepage, in the administration guide or in the securing-applications overview. | Agent identity: owned identities, key-bound tokens, delegation, approvals, kill switch. |
| Source and support model | An open source project (homepage). | A commercial product from one vendor, SSOGEN Corporation, in production since 2016. |
Where the products overlap
Both do the standard identity provider job.
Keycloak. It holds users, or federates them from a directory. Apps that speak SAML or OpenID Connect redirect to it.
SSOGEN. It does the same with local accounts, a directory or an upstream provider.
Sign-in policy. SSOGEN also applies a named sign-in policy per app.
Where SSOGEN documents more
Apps that cannot redirect. Oracle E-Business Suite, PeopleSoft, JD Edwards and in-house sites behind Apache all predate SAML and OpenID Connect.
Keycloak’s Apache path. Keycloak’s guide sends Apache users to third-party modules it does not officially support.
The Web Agent. It is SSOGEN’s own module, supported by SSOGEN. It signs people in, then tells the app who they are.
The App Proxy. Where you do not control the web server, the App Proxy checks sign-in first, then forwards the request.
Choosing a connection. The choosing guide shows how SSOGEN decides between SAML, OpenID Connect, the Web Agent and the App Proxy.
AI agents. SSOGEN registers each agent as a non-human identity. It gets up to five owners, an expiry date up to 365 days out (or a review date), and an explicit list of apps and scopes.
Agent proof. The agent proves itself with a key pair. Its tokens are tied to that key and last about four minutes.
Agent approval. An agent acting for a person needs that person’s approval. Scopes marked Sensitive need a fresh approval every time.
How a move from Keycloak works
During a move, SSOGEN accepts Keycloak as an identity provider. People sign in with their Keycloak accounts while applications move one at a time.
Two Keycloak client settings matter for SAML:
- Sign assertions. Turn it On, because SSOGEN requires a signed assertion.
- Client signature required. Turn it Off on the Keys tab, unless you enabled request signing in SSOGEN.
Both come from SSOGEN’s SAML guide. Keycloak’s administration guide describes both options; in the text we read, it does not state their defaults. Check them in your version.
For OpenID Connect, enter the issuer exactly as Keycloak publishes it, like https://keycloak.acme.example/realms/acme, with no trailing slash. Steps are in Keycloak SSO with SSOGEN.
Where Keycloak fits
- Apps that redirect. Your apps already speak SAML or OpenID Connect and redirect to the provider.
- Open source. You want an open source project your own team runs.
- Your own apps. You are securing apps and services you build yourself, and you value a project whose own pitch, on its homepage, is adding authentication “with minimum effort”.
- No vendor contract. Your team can run it, and you do not need a vendor contract behind it.
When SSOGEN fits
- Apps that cannot redirect. You cannot change them. The Web Agent and the Gateway sign people in without touching the app.
- Agent identities. AI agents need identities with owners, expiry, consent and a kill switch.
- One commercial vendor. Identity provider, MFA, provisioning and audit, backed by SSOGEN support.
Questions people ask
Is Keycloak an SSO provider?
Yes. Keycloak’s administration guide calls it “a single sign on solution for web apps and RESTful web services”, and the homepage describes single sign-on, where “Users authenticate with Keycloak rather than individual applications”.
Is Keycloak open source?
Yes. Keycloak’s homepage describes it as “Open Source Identity and Access Management” (read 2026-10-09). SSOGEN is a commercial product, so the choice also decides who does the operating work and holds the support contract.
Can Keycloak be used as an identity broker?
Yes. Keycloak’s server administration guide lists Identity Brokering as a feature: users authenticate with an external OpenID Connect or SAML 2.0 identity provider (read 2026-10-09). SSOGEN also takes outside providers, as the identity providers overview explains.
How does SSOGEN connect to Keycloak?
Add Keycloak to SSOGEN as a SAML or OpenID Connect identity provider. The Web Agent can also run as a client straight against Keycloak. Those standalone modes need a license key from SSOGEN.
Which costs less?
This page makes no pricing claims.
More: the identity-aware proxy overview, how the open-source Apache modules compare in mod_auth_openidc and mod_auth_mellon alternatives, and single sign-on software for the whole product.
About this comparison. SSOGEN Corporation prepared this page from the Keycloak project’s public documentation and web pages, last read on 2026-10-09.
We took care to be accurate, but products, plans and prices change, and we may have misread or missed something, so some statements may be wrong or out of date. This page is for general information only and comes without any warranty.
SSOGEN is not responsible for errors, omissions or decisions made from it. Check the vendor’s own pages and test the products yourself before you decide. If you see a mistake, tell us and we will correct it.
Keycloak, Cloud Native Computing Foundation, Active Directory, Entra ID, Okta, Oracle E-Business Suite, PeopleSoft, JD Edwards, Apache, mod_auth_openidc, mod_auth_mellon and Oracle HTTP Server are names or trademarks of their respective owners. SSOGEN is an Oracle partner, but Oracle has not reviewed or endorsed this page.
Except for Oracle, the owners named are not affiliated with, endorsed by or sponsored by SSOGEN.